Community plugins
Installing plugins written by other people, reading their permissions before you trust them, and keeping them up to date.
Pivit's plugin API is the same one the built-in plugins are written against, so a plugin someone else wrote can do anything the ones in the box can. That is the point, and it is also the reason this page spends most of its length on trust.
Where they come from
The Pivit Store is not open yet. Until it is, community plugins are distributed the way any small package is: a release archive or a repository you build yourself, usually published on npm alongside it.
When the store opens, installing will move inside the app. Nothing about the plugins themselves changes.
Installing one
Get the built plugin. A plugin ships as a folder containing its compiled output and a package.json. If you were given a repository rather than a release, build it first, following its README.
Point Pivit at the folder. Under Settings → Plugins, add it as a local plugin.
Read the permissions. Pivit shows what the plugin reaches for before it is installed. This is the moment to look.
Check it appears. The plugin gets its own page in settings, and its commands show up in the bar. If nothing appears, run Reload Plugins from the command bar.
Permissions, and what they are worth
Plugins declare what they need to reach outside Pivit — the internet, your clipboard, notifications, stored data. You see that list before installing.
Pivit does not simply take the declaration at face value. It scans the plugin's code for the host calls each permission gates and adds anything it finds to what was declared, so a plugin that quietly does more than it claimed shows the discrepancy rather than getting away with it.
That check is a floor, not a guarantee. It tells you what a plugin can reach; it cannot tell you what it will do with it.
A plugin runs as code on your machine with the permissions you grant it. Install from sources you would take any other software from, and treat a plugin asking for more than its description would suggest as a reason to look at what it actually does.
Permissions are hierarchical: a plugin granted clipboard has both read and write. A plugin asking only for clipboard.read is being deliberately narrow, which is a good sign.
Updating
Local plugins do not update themselves. To move to a new version, replace the folder's contents with the new build and run Reload Plugins, or restart Pivit.
Your settings for that plugin survive the update, because they are keyed to the plugin's identifier rather than its version.
When something goes wrong
A plugin that fails to load is reported rather than passed over silently, and the rest of Pivit carries on — one broken plugin does not take the command bar with it. Settings → Logs has the detail.
If a plugin is misbehaving, disable it first and remove it once you have confirmed that was the cause. Disabling is instant and reversible.
Writing your own
If nothing does what you need, the API is public and the loop is short — a command that opens a URL is about ten lines.